GraphQL Authorization with Open Policy Agent - Mike Cohen

Authorization is a crucial aspect of any API, including GraphQL. The complex nature of GraphQL requests can make it difficult to implement fine-grained authorization rules that restrict access to specific fields or arguments. Ensuring a consistent implementation across subgraphs further complicates this task. In this talk we'll explore how Indeed leveraged Open Policy Agent and the Rego policy language to enforce some authorization use cases for all subgraphs at the OneGraph layer.